Overview

overview

10

Static

static

10

ezrat.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ezrat.exe

  • Size

    910KB

  • MD5

    789a48413608ca25fbfa0c89494b70fc

  • SHA1

    95dbad2f6d28614abf7b5e9199aff94ee6724ca7

  • SHA256

    de338e0379af8619e9d16f1e6a5e756e2edf89ae76454b35bdd6a27206f54383

  • SHA512

    b9203b039df11c56d17ee9f9f07ad15f0eaadc0ff13bfa9dbd727e7baf9704d41602586575d65573aad8592789e6b4183cbe0b194d63046b303f4e5c4417b1e8

  • SSDEEP

    12288:dRzyAHWSkJ6ZBy37dG1lFlWcYT70pxnnaaoawISIh4BBpGFrZNrI0AilFEvxHvB9:8k84MROxnFh/iArZlI0AilFEvxHiyZr

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

centre-shaped.gl.at.ply.gg:30014

Mutex

d7dbdc848db8416eac3dcee2ced8975e

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ezrat.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections